Can an Employer Ask for Your Medical Records?

An employer can ask for medical information relevant to a legitimate workplace decision, but it does not have an automatic right to an employee's complete medical records. A broad request must be distinguished from focused evidence about absence, current capacity, safety or adjustments.

In many cases, a medical certificate or functional report can answer the employer's question without disclosing consultation notes, unrelated diagnoses, family history or years of treatment records.

The lawfulness and reasonableness of a request depend on the role, purpose, existing evidence, contract, industrial instrument, privacy setting and whether less intrusive information is available.

This article focuses on records. For ordinary absence evidence, read Can an Employer Ask for a Medical Certificate in Australia?.

This is general workplace and privacy information, not legal or medical advice. Obtain advice before refusing a formal direction or authorising broad disclosure.

Key Points

• A medical certificate is not the same as a medical record.
• Employers should identify the work decision and information genuinely needed.
• Complete clinical files are rarely necessary for routine sick leave.
• Functional capacity reports can often protect diagnosis privacy.
• Consent should be informed, specific and limited.
• Health providers must maintain confidentiality unless disclosure is authorised or lawful.
• Safety, long absence and adjustments can justify focused additional evidence.
• Medical information should be securely stored with restricted access.

Medical Certificates

What Counts as a Medical Record?

A medical record can include consultation notes, diagnoses, symptoms, medicines, test results, imaging, referrals, specialist letters, mental health information and treatment plans.

It is much broader than a certificate that confirms unfitness for specified dates or a capacity form listing work restrictions.

Records often contain third-party and unrelated information. A request for “all records” can disclose far more than an employer needs for a particular employment decision.

Ask the employer to identify exactly which document or questions it means rather than assuming the label is precise.

Routine Sick Leave Usually Needs Less

For an ordinary absence, the relevant question is whether personal illness or injury made the employee unfit and for what period. A properly issued certificate can commonly satisfy that need.

The Fair Work Ombudsman says evidence must convince a reasonable person of entitlement but does not prescribe a complete medical file.

A manager organising shift cover does not ordinarily need laboratory results, therapy notes or a medication history.

Read What Is a Medical Certificate? for the narrower document.

When Additional Information May Be Relevant

A focused request may be reasonable after extended absence, repeated uncertainty, a significant safety issue, conflicting certificates or a need to understand reasonable adjustments.

The employer may need information about current restrictions, expected duration, review timing and whether identified inherent duties can be performed.

That does not mean every clinical entry becomes relevant. Ask whether a practitioner can extract the necessary opinion into a capacity report.

See Can an Employer Ask for More Evidence After a Medical Certificate?.

Diagnosis vs Functional Capacity

A diagnosis names a condition. Functional information explains what the employee can safely do, what should be avoided, how long restrictions may last and when review is appropriate.

Two people with the same diagnosis may have different capacity, so records do not necessarily answer the work question better than a tailored assessment.

The employer can provide accurate duties and ask the practitioner to address lifting, driving, hours, concentration, exposure or other relevant functions.

For diagnosis boundaries, read Does a Medical Certificate Need to State Your Diagnosis?.

Consent Must Be Meaningful

A health provider generally needs patient consent or another lawful basis to disclose records. Consent should identify the recipient, records or questions, purpose and relevant time period.

Employees should read authorisation forms rather than signing a blanket release under pressure. They can ask why each category is needed and propose narrower wording.

The employer should not represent refusal of an unlimited consent as refusal to provide any relevant evidence. It should consider a proportionate alternative.

Consent to authenticate a certificate does not automatically authorise disclosure of consultation notes.

Can the Employer Contact the Clinic Directly?

An employer may contact a clinic to check whether it issued a certificate, but further clinical information generally requires consent or another lawful authority.

The RACGP employment law guidance discusses confidentiality and work-capacity requests to general practitioners.

A transparent process sends focused questions through the employee or under a specific written authority and lets the employee know what was provided.

Read Can My Employer Call My Doctor in Australia?.

Book Online Consultation

The Privacy Act and Employee Records

Health information is sensitive information, but privacy obligations differ between collection by an employer, handling by a health provider and storage after information becomes an employment record.

The Office of the Australian Information Commissioner employee records guidance explains that the private-sector exemption is limited to specified acts directly related to an employment relationship and an employee record.

It does not mean an employer can collect anything it wants. Government workplaces and state or territory health privacy regimes can have different requirements.

Contractors, prospective employees and third-party occupational providers may also fall outside the same exemption.

How Records Should Be Handled

The employer should collect the minimum information required, state the purpose, use secure transfer and limit access. A direct manager may only need restrictions and review dates.

Reports should not be kept in an open team drive or forwarded to colleagues who are not making the decision. Retention and destruction should follow applicable record rules.

Employees can ask who will receive the information, where it will be stored, how long it will be retained and whether an insurer or adviser will receive it.

A workplace privacy breach should be raised promptly through the organisation's privacy process and regulator where appropriate.

Safety-Critical Roles

A genuine risk can justify more detailed assessment in transport, aviation, clinical care, emergency services, machinery or other safety-critical work.

The request should match the medical standard or hazard. An occupational physician may need relevant records to form an opinion, but unrelated history remains outside the proper scope.

The employee should disclose enough to prevent immediate harm and comply with applicable licensing or fitness standards.

Safety obligations should not be used as a generic reason for unlimited access in low-risk circumstances.

Disability and Adjustment Requests

An employee seeking an adjustment may need to provide information showing the functional limitation, likely duration and useful workplace change. Complete records are not usually the only way to do that.

The Australian Human Rights Commission disability guidance discusses disclosure choices and employer questions about safe performance and adjustments.

The employer should assess actual inherent requirements and possible reasonable adjustments, not assume diagnosis determines capability.

A practitioner can provide a focused recommendation while preserving unrelated history.

Independent Medical Examinations

In limited circumstances, an employer may direct an employee to attend an independent medical examination rather than request treating records. The direction still needs a lawful source and reasonable scope.

The examiner may request relevant records to answer defined capacity questions. The employee should review consent, information supplied, report recipients and examination logistics.

A Fair Work Commission decision concerning medical examination directions illustrates the fact-specific inquiry.

See Can an Employer Require an Independent Medical Examination?.

Workers Compensation and Insurance

A workers compensation claim usually requires more medical information than ordinary sick leave because the insurer must assess causation, capacity, treatment and benefits.

Scheme legislation can authorise reports, examinations and records subject to procedural safeguards. Income protection policies can have separate consent terms.

Read the claim authority carefully and ask which providers and periods it covers. A claim-related disclosure should not automatically become unrestricted workplace access.

Seek scheme or legal advice if an authority appears broader than necessary or benefits are threatened.

Recruitment and Pre-Employment Records

Questions before employment should relate to inherent requirements, safety and lawful adjustments. Applicants should not be asked for broad medical history merely to screen out possible future illness.

Different privacy rules can apply because the applicant's information is not yet a current employee record. Disability discrimination protections may also be relevant.

A role-specific pre-employment assessment should explain the standard and information collected. It should not promise employment merely because a person attends.

Applicants should answer lawful relevant questions truthfully and seek advice about intrusive requests.

What If Records Contain Third-Party Information?

Clinical notes may mention partners, relatives, carers or other patients. That information can be irrelevant and raises additional confidentiality concerns.

A treating practitioner can prepare a report rather than release raw notes, or redact third-party material where lawful and appropriate. The employee should not alter original records themselves.

Test results may also require clinical explanation and can be misleading when read without context.

This is another reason to prefer targeted questions over bulk file transfer.

Accessing and Checking Your Own Records

An employee may want to review records before authorising disclosure so they understand what is relevant and can identify factual errors. Patients can request access from a provider, subject to lawful limits and its access process.

Do not edit a clinical record before giving it to an employer. Ask the provider to correct inaccurate facts or prepare a focused report that explains the current opinion.

A record can be technically accurate yet misleading without context, such as an old provisional diagnosis that was later excluded. The practitioner can explain chronology and current relevance more safely than the employee selectively deleting pages.

How an Employee Can Respond

• Ask for the purpose and exact records in writing.
• Identify the workplace decision and relevant duties.
• Offer a focused capacity report where suitable.
• Limit consent by recipient, subject and period.
• Ask for copies of questions and reports.
• Use a secure submission channel.
• Seek advice before refusing a formal direction.

How an Employer Can Narrow the Request

• Review evidence already supplied.
• Define inherent duties and objective concerns.
• Ask functional questions instead of seeking all notes.
• Explain consent, access, retention and recipients.
• Consider treating-practitioner clarification first.
• Give the employee a fair opportunity to respond.
• Obtain advice before adverse action.

The broader information framework is explained in What Medical Information Can an Employer Ask For?.

More of Our Services

Using Dociva

Dociva provides online sick-leave, carer's leave, study and multi-day medical certificate requests, together with standard and extended telehealth consultations. An Australian registered medical practitioner assesses each request independently, and a certificate or particular wording is not guaranteed.

Dociva also provides standard and extended online consultations for broader clinical questions, including requests that may involve employer forms or capacity information. Any records review remains limited by consent, relevance and clinical appropriateness.

Dociva does not release complete medical records to an employer merely because it asks. Any disclosure must respect confidentiality, consent and applicable law.

For a genuine need within a supported category, review the current medical certificate request options. Complex records or work-capacity questions may require a regular treating practitioner, specialist or in-person assessment.

Frequently Asked Questions (FAQs)